Cysic Suspends Bridge After Unauthorized Minting of 10 Million CYS Tokens

Cysic has announced the suspension of its cross-chain bridge after an unauthorized minting incident involving 10 million CYS tokens on the BNB Smart Chain on October 17, 2026. The company stated that the issue was confined to bridge message processing and minting, and that its mainnet and other operational systems remain unaffected.

The unauthorized mint occurred at 12:31:38 UTC, and by 13:47:52 UTC, Cysic had blacklisted the address that received the tokens. At that time, approximately 2.8 million of the minted CYS were still in that address, indicating that a significant portion of the tokens had already been moved before the freeze was implemented.

Cysic has engaged third-party security experts to investigate the incident and is tracking the movement of the exploited tokens. Early findings suggest a potential link to unauthorized database access and weaknesses in the bridge’s processing logic. However, Cysic has yet to confirm the full attack vector or root cause, which are still under evaluation.

This incident highlights ongoing vulnerabilities in bridge minting processes, reminiscent of a similar exploit that affected Syscoin in June 2026. With a maximum supply of 1 billion tokens, the addition of 10 million unauthorized tokens poses a significant dilution risk for CYS holders, especially since only about 2.8 million of the minted tokens are confirmed frozen.

Currently, users cannot transfer CYS across chains using Cysic’s bridge, and no timeline has been provided for its reopening. The investigation's findings may prompt broader discussions about security measures for bridge operators, particularly regarding the protection of off-chain systems.